Hi, >> # 2013 cars local dealership >> http://pastebin.com/3bEMiV3B > > URI in that sample > > pohformed.com listed on black.uribl.com > pohformed.com listed on jp.surbl.org > pohformed.com listed on sc.surbl.org > pohformed.com listed on dbl.spamhaus.org
I know I should have mentioned that. Yes, I'm using the above RBLs, and they're all correctly tagged here now. I was hoping for something more preemptive to trigger on these more generally because the IPs are only used for a short while, but long enough to get 25 spams in from the address. I was hoping to find commonalities between the messages that could be used to generate some other rules. Thanks, Alex
